tv The Communicators CSPAN June 25, 2016 6:30pm-7:01pm EDT
both conventions on c-span, beginning monday, july 18. ♪ congressman will hurd, the republican from texas, is the chair of the senate committee for technology. corpsman heard, before you became a member of congress, what were you doing? when i graduated from texas a&m university with a degree in computer science, i went straight to the cia. i was an operations officer, so i was the dude in the back alleys at 4:00 in the morning collecting intelligence on our homeland. i spent to been years in washington, d.c. training, two years in india, two years in new york city, and a year and a half in afghanistan. the cia, i became a
partner at a consulting firm and helped start a private security company that did things like penetration testing, helping businesses, manufacturers defend their digital infrastructure from attackers. host: how has that benefited or affected your work in congress? reallyrd: it has been important. one of the values i bring his a unique background and experience on issues of national security or cyber security, and having spent a good deal of my adult life chasing terrorism, dealing with al qaeda, looking at iranian nuclear proliferators, this has helped. i have direct experience in some of the most pressing national security issues. having been in the private sector and seeing what the private sector is doing in order to defend their digital infrastructure, some of our banks, their ability to protect
themselves from attacks every day is important. that and bringee that experience as the chairman of an id subcommittee has been invaluable. takes toand what it defend a digital network, the difficulty of it, but also the basic best practices of good digital hygiene. theg able to recognize current state that many of our agencies are in, and what the future state should be, and having an idea of how to get there, i think, is very important. it is especially important, the oversight ruled that congress plays. the u.s. government is spending approximately $80 billion a year in technology and cyber security all stop are we getting -- cyber security. are we getting our money's' worth? rep. hurd: no. your viewerstuff
would think is old and outdated. that is absolutely outrageous. this is an issue that i spend a lot of time on. i.t. pair. .- i.t. procurement that is not a sexy topic. the reality is, the way we can reduce the size and scope of the federal government is how we purchase goods and services. the way we make our government more efficient is to utilize the latest technologies, and we have to make sure that the folks defending our networks are using the latest techniques, the latest tools. the pushed security administration as a perfect example. this is an agency that has information on every american, and a lot of information on our seniors. we need to make sure that information is being protected. is department of education another example. it has so much information on our students from all across the country, and that information can be used in order to make fraud, and can ultimately create
long-term problems for our kids. host: joining her congress -- joining our conversation today, tim stark covers cyber security for politico. >> good afternoon to you. that is intended to improve some of the problems you are talking about. explain the importance of that law, in particular to how it would apply to security? and how do you think agencies are implementing it so far? rep. hurd: -- so far? -- rep. hurd: this law was ultimately designed to empower the cio's within these various agencies. is, theoretically the cio was supposed to be the one to have the responsibility to implement i.t. projects, to direct and spend, but that was not happening. the law was designed in order to strengthen the cio's role, and
also to make sure they are doing things like agile development, that when you have these big, expensive projects, you are realizing victories and deliverables over a six-month period, rather than spending half $1 trillion over four years overlf-a-trillion dollars four years. the scores are based on new information that the agencies are providing to us themselves. this is their own information. they know exactly how the score is arranged. the reality is, out of 24 agencies, we had one agency get a b, one agency get a f, and everybody else was in between. this has focused the conversations on things like
data center consolidation. the federal government has almost 11,000 data centers. facebook am a one of the world, -- facebook, one of the biggest companies in the world, has four. four agencies have realized $2 billion worth of savings over the past two years by moving into the cloud. these scores were designed to shine a light on some of these problems on some key elements that if we get right, we can improve the efficiency's insecurity of the federal government's digital infrastructure. farther, ciowe go is an acronym for chief information officer. tim stark. you talked about, if i recall correctly, the last four shows a number of agencies moving up.
do you think they are moving up fast enough and showing the kind of progress you would like to see? rep. hurd: i believe six agencies moved up. that was a good trend. i would like to see it faster. realitiesy is, these in which the chief information officers are operating are pretty large, so i don't think we can do to improve security fast enough. there is no silver bullet when it comes to protecting digital infrastructure. the reality is, you have to begin with a prescription -- the presumption of a breach. you detect, can them, quarantine them, and can you kick them out of your network, and how fast? been years ofs mismanagement, of not investing in current technology. this is an important reason that scores, to continue to shine a light on this, continue to put pressure on
these agencies and make sure they are doing the right thing in order to protect our digital infrastructure, so that we don't have something like the opm hack, or 23 million records of folks who went through a security background was breached. we are not moving fast enough. we also need to make sure these agencies have the flexibility. if they have savings, but they are able to use that savings on other issues throughout the networks. of, the president has his own proposal to deal with some of these issues. the i.t. monetization proposal, money that he hopes by investing will eventually mean more billions of dollars in savings. that proposal does not seem to have any money in any of the spending bills in the house or senate. i'm wondering if you think that is a good idea, and in particular, do you think it is something that might be happening before the president leaves office? the concept is a
valuable concept. we need to make sure our agencies are monetizing. but here's the reality. you have to constantly stay ,p-to-date on the latest trends tactics, techniques, and procedures in developing your network. the reality is, it is hard when you are already spending $80 billion a year on purchasing i.t. business services. when 80% of that is on legacy systems, it is hard to justify another $3 billion. why not use the $80 billion more successfully? when you do certain things to realized savings -- i talked earlier about how quattro agencies, moving into the cloud has saved $2 billion. agencies, it -- four moving into the cloud has saved $2 billion. imagine if agencies had funds to where they can do monetization in their network. the cios are planning their
budgets, they have to be thinking about long-term and how they can move aged systems into the future. how can they get rid of old systems? we had a bipartisan and bicameral letter that was sent out to all the agencies that asked for hardware on software -- hardware and software that was no longer supported by vendors. the information we got back is staggering. there are programs that vendors are not providing support for back from 1993. so the government can continue to do the right upkeep to patch the software, to understand the vulnerabilities, i think that is unrealistic. moving forward on monetization tant, but this should be a day-to-day thing for our cios nrc isos -- cio's and our ciso's.
many argue they are proposing oversight mechanisms. do you think those can help? rep. hurd: if you get a cio the realizedty that they savings and are able to use that over multiple calendar years, i think that is a good tool. in reality, when you talk about some of those big projects with in the federal government, the problem of the federal government has is scale. many of the products you are talking about -- projects you are talking about are huge. that takes a different mindset. to try to realized savings in one calendar year and use that in the same calendar year is hard to do. cio's have that the that capability, freedom, and flexibility is important. i think part of the plan is to within the federal government placed in the omb.
i think that is a plausible step. scottrrent one, tony , he has great experience in the private sector, knows what it is like to defend networks, and he has been able to leverage that experience in the government. having someone like that who is focused specifically on security is a good idea. ciso congressman heard, stands for? rep. hurd: chief information security officer. host: you have heard the current one say that the current situation with cyber security is a bigger problem than y2k. do you agree? rep. hurd: absolutely. here's the reality. the number of hackers coming after us are increasing, and the level of sophistication is increasing all stop as we move to a more interconnected world, that increases our surface area of attack. the full set have the capabilities to get into our system is large.
have thethat capabilities to get into our system is large. the reality is we can also be learning from our private sector colleagues, and information sharing is important. cyberss passed the security act of 2015, a very important legislation that will make sure we have the tools in order to improve information sharing between the federal government and the private sector. you have information-sharing , usually within a particular industry, that try to share information along comes -- amongst themselves. but if we try to share information between the five it -- the private sector and the federal government, that is great. we know there are russian hackers in moscow that are making the next level of malware that will be used to penetrate our digital infrastructure and our banks. -- there financial
financial services industry might know where ther attacks may come from. gete are able to information to the private sector in order to help them defend and get one leg up on the attackers, this is one way we can take our defensive game to the next level. another one of the things the administration wants to do to respond to the changes you are talking about israel 41, which changes of the government will get warrants for its own hacking. there was protest recently about that. congress has until december 1 to block it if it chooses. where do you fall on the scale of that being a threat to privacy versus being necessary? rep. hurd: here's the reality. we can protect our digital infrastructure and our civil liberties at the same time all stop civil liberties are not bourbons.
a make our country great. -- at the same time. .ivil liberties are not burdens they make our country rate. tocan still take the fight those trying to attack us. a lot of these attacks are ining from off-shore countries that do not have rules for this kind of behavior. the hackers know that, the countries know that. there are tools we can be using, and we can also work with these countries to pass several security legislation, to make this kind of behavior illegal. that is another way we can press on this. again, the devil is in the details, and we have to make sure we are protecting civil liberties while doing everything we can to take the fight to the bad guys. rep. hurd: tecumseh degrees of security, does -- it comes to degrees of security, does the and i say and other do -- do the nsa and
other departments need the same level of security? rep. hurd: good question. the concept is called defense that. -- depth. it is really hard and expensive to do. when you design the data that is flowing across your network, you have to think, what are the most important things that need to be protected, and make sure that you design your system to protect that and have the tools to protect that. the nsa has certain things that need to be protected to a certain level, congress may have some too, but we can't think of a one-size-fits-all solution when it comes to cyber security. that's why we have to make sure our cio's are involved in the planning. what is the most important thing to protect, how can we protect that, and continue to allow the movement of information for people to do their job and provide services, but this is something we need to make sure
the folks that are involved in ourect -- in protecting digital infrastructure understand. this is a philosophy that has been around in the private sector for some time, and we need to see more of that in the federal government. tim: are you finding the agencies eager or reluctant to upgrade their technology and cyber security? rep. hurd: one of the frictions that you see is, many of the cio's across the various agencies understand what they need to do. they are getting pushback and friction from some of the cfo's, because they feel like they are authorityosing some and power. that's not what this is about. this is about making sure the technical experts are involved in defending those networks. that is one aspect to this problem. i think the cio's, it has been good to see how some of these agencies have been reaching out to the department of homeland security and the folks involved testlping to defend and
some of the networks within the federal government. that partnership is new, it is growing, and it is working. happy to see that those kind of relationships are happening. ciothe reality is, if a thinks they can do this all by themselves, or have all the tools and don't need help from anyone else, they are wrong. making sure that they are going out and asking for the help when they can. tim: i want to return to the two things you said. the role change, you said you are still studying at? is that what i am picking up from you? rep. hurd: yeah, this is accommodated issue, and we need to spend more time studying it. tim: understood. you also mention russia. they have been in the news lately. congress and the administration have either introduced legislation or have had talks, or have issued sanctions, or
have threatened sanctions against north korea, iran, china . has the administration and/or congress taken its i off the ball in russia, kind of having a targeted agenda with cracking down on cyber hacking? i think this administration has taken its eye off russia on many fronts. nobody should be surprised that the russians were involved in hacking american systems in order to try to get a leg up on potential future negotiations. the reality is, though, what is a digital act of war, and what is the appropriate response? there is not a government answer or response to that. different parts of the government have an idea of what that means, but the reality is, if north korea launches a missile into san francisco, we know how we think the u.s. government will respond, and the north koreans know how we will respond. that is a physical-on-physical attack.
digital-on-digital attack? maybe it is physical, maybe it is sanctions, but there is not clear understanding and agreement on what is an act of war and what is an appropriate response. until we have those conversations and red lines, it is hard to have a conversation about any individual actor, because we have not agreed upon what is a redline. , there was a recent eyeort by the company fire saying cyber hacking has dropped things the administration has done. is that your understanding, and if so, why do you think it is happening? rep. hurd: that is my understanding of that report. the question is, that is a perspective of one entity on their networks, and they are a very well respected organization. i believe what they are saying,
what the question is, have we seen the same level of potential drop-off in attacks on federal infrastructure, on military infrastructure, on national security infrastructure? that's the question i do not know. but the reality is, when you do hey,bution, when you say, we got hacked by these folks, that is a method of deterrence, too. i think in escalating some of these attacks and talking about her the chinese were involved, i think that is a deterrent in kind of decreasing what they think they can get away with. this is an ongoing conversation, and again, we cannot be lulled just because we have ada overbay handful ofta over a months that suggest attacks have come down. the reality is, we should not make any long-term assessments on that information until we have years worth of that data. heard, --ressman
congressman hurd, you mentioned the office of personnel attack. what are the revocations -- the ramifications we have seen? rep. hurd: the ramifications are that there are still assaults where we may or may not know that the information was stolen. it is hard to pinpoint whether some individual that experienced fraud, if that was because of their information getting stolen and that opm hack. it has in a year -- been a year since the american people have become aware of that hack, and there is still a lot more information that we need to understand in order to have a longer-term assessment. is a lot ofecords records. some of that information you don't have to take advantage of right away. it can be used three or four years from now. my fear is that a couple of years from now, we stopped
talking about opm hacks, and that's when the bad guys who took the information start using that to conduct fraud and things of that nature. congressman, you used the is not a very sexy issue. how do you get the attention of appropriators, leadership, etc.? rep. hurd: even though it may not be sexy, people realize it is important. i represent 29 counties in texas. urban areas and rural areas. donee last months, i have more than 200 meeting grades. there is a question i have gotten that everyone of those. the question of a ride -- of national security, and other question is on cyber security. -- theyre nervous that keep reading about these high-profile attacks that have happened almost every week. how many people have had to get
a new credit card because their information was stolen somewhere? this is something that impacts everyone. ofhink some folks are afraid the difficulty of the topic in the technicalities involved, but people definitely recognize that this is a threat, and that this has only become an increasing threat as we move into a more interconnected digital age. we can talk about the internet of things, where all of our devices start talking to one another, driverless cars. as we put more stuff into the cloud and connect to one another, that increases potential areas that people can attack. we can continue to grow and leverage technology for good, but we have to think and began with security in mind and how we protect that information. issue you have been pretty active on, congressman, is something called the wass our arrangement. arrangement.
individuals have gone to vienna things that address might hurt cyber security companies. have you an update on how those would bet, and what the final thing you would like to see happen to make that better? rep. hurd: i think this whole has been a success. a multilateral agreement was negotiated, and the u.s. government is trying to figure out how to implement it. they got feedback from the private sector, and the private sector said there will be long-termoblems and ramifications that were not taken into account when this was negotiated. the department its kudos for recognizing this. congress has a role in providing oversight and having a conversation on that, and the state department decides to go back and renegotiate the entire multilateral agreement. they decided to take private sector experts to europe for the
negotiations. victory, and what i have heard about these negotiations over the last couple of days is that the technical expertise of the came fromctor, that the private sector, was doaluable in discussing, how we have a multilateral agreements that helps prevent bad guys from getting some of these tools, but does not hurt international businesses, local businesses from doing everything to protect themselves? i think this is a good example of when strong oversight from congress led to something that was a good outcome. and finally, congressman, what can we expect from your subcommittee in the coming months or year? rep. hurd: one of the things you can expect is talking about, what is a digital act of war? we are also looking at, how do chief information officers within an agency to
utilize some of the savings they realized in their network for other projects? these are two big areas that i think are very important -- two areas that i think are very important. we continue to play our oversight role and making sure our agencies are moving in the direction of security of. -- security. one thing i am passionate about is making sure there is true cooperatively between the carbon of -- the department of defense and the v.a. soldier, sailor, airman, marine, should not be told to leave the vod to print out their health records and physically carry over them to the v.a. it is 2016. we should be able to hit a button. if they can achieve true interoperability, they could be a standard for the world. that will leads to a lot of
great things, everything from , whereesearch code work you can do testing on drugs faster, where you can get life-saving drugs to the market quicker. where you can, as an individual, see all the doctors visits you have ever had. that will help you be healthier and live longer. really exciting things, and the federal government can actually lead in this area if we get our act together. congressman will hurd from texas is a freshman and a cyber security. this is "the communicators." [captions copyright national cable satellite corp. 2016] [captioning performed by the national captioning institute, which is responsible for its caption content and accuracy. visit ncicap.org] sunday, hillary clinton speaks at the mayor's conference in indianapolis. we will have live coverage of her remarks beginning at 4:00 p.m. eastern. c-span's conversation with democratic presidential candidate senator bernie sanders
of vermont. p.m.an see that at 6:30 and 9:30 p.m. eastern on c-span. you realize, this is something i would not only love to do, but something i think could be really different from the kinds of books that have been written about macarthur in whichst, and the way in to really rethink and reevaluate who this person was, what his significance was, what his were that made him one of the most adored and agitated figures -- adulated figures were that made in american history, but what were his flaws and things that made him a really ways unpleasant and hated. arthurer: sunday night, herman takes a look at the life and career of douglas macarthur in his book "douglas macarthur: american warrior." i think that's one of the things
about macarthur that you can say. he saw the future more clearly than he saw the present. ofther it was the rise china, the split between china and the soviet union, which he foresaw, but also perhaps the fate of american domestic politics. 8:00ncer: sunday night at eastern on c-span's q&a. announcer: tom wheeler discussed the future of wireless communication at the national press club on monday. he stressed the importance of u.s. leadership in the development of 5g, the next standard of cellular networks. this is an hour. >>